release: v2.1.17

Render upload progress from fractional transfer values while keeping the visible percentage rounded. Move the green fill with a linear compositor transform and cover the 92-to-93 percent transition with monotonic frame-level Electron assertions.

Keep Electron UI verification listeners loopback-only so development validation no longer raises a Windows Firewall prompt under electron.exe. Extend the public source allowlist with the focused network safety regression coverage.

tests/ui-network-safety.test.js

@@ -0,0 +1,47 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const net = require('node:net');
+const RemoteServer = require('../lib/remote-server');
+
+let networkSafety = {};
+try {
+  networkSafety = require('./support/ui-network-safety');
+} catch {}
+
+test('Electron UI test listeners bind only to loopback', async () => {
+  assert.equal(typeof networkSafety.listenOnLoopback, 'function');
+
+  const server = net.createServer();
+  try {
+    await networkSafety.listenOnLoopback(server);
+    const address = server.address();
+    assert.equal(address.address, '127.0.0.1');
+    assert.ok(address.port > 0);
+  } finally {
+    if (server.listening) await new Promise(resolve => server.close(resolve));
+  }
+});
+
+test('Electron UI remote server guard keeps the real server on loopback', async () => {
+  assert.equal(typeof networkSafety.installLoopbackRemoteServerGuard, 'function');
+
+  const observedAddresses = [];
+  const restore = networkSafety.installLoopbackRemoteServerGuard(RemoteServer, address => observedAddresses.push(address));
+  const server = new RemoteServer();
+
+  try {
+    await server.start({
+      port: 0,
+      token: 'ui-network-safety-token',
+      allowInput: true,
+      onSignalingToCapture: () => {},
+      onCreateCaptureWindow: () => {},
+      onDestroyCaptureWindow: () => {}
+    });
+    assert.equal(server._wss.address().address, '127.0.0.1');
+    assert.deepEqual(observedAddresses, ['127.0.0.1']);
+  } finally {
+    server.stop();
+    restore();
+  }
+});